Yet another huge security hole uncovered on all HTC EVO devices

Well, it looks like we should be expecting another OTA security update from HTC fairly soon. This time, there’s a security hole that seems to effect all WiMAX-enabled HTC Android devices; in other words, all members of the HTC EVO family.

Here’s a detailed description of the bug, according to developer TrevE, who discovered it:

Those of you who enjoy the speeds of WiMax on their 4G enabled devices are doing so with an inherent risk. It turns out that WiMax is even more open than the HTC logger app. The more technical details are basically that an attacker who gains control over this can potentially manipulate data connectivity and to go even as far as being able to completely reprogram your device’s CDMA parameters remotely! This is done through two open ports that basically require no authentication and just as before, the only thing required for a malicious app to do anything is INTERNET permission. The other interesting thing that came out of this discovery is that apparently you can also send commands to the radio via the WiMaxmonitoring port, and sending a single coma can create an “out of bounds range exception” basically crashing your device.

TrevE has been in touch with HTC about this, and he says they’re already working on a fix. In the meantime, be careful about what apps you’re downloading (i.e. only download trustworthy apps from established developers, don’t download pirated versions of apps, etc.).

Pocketables does not accept targeted advertising, phony guest posts, paid reviews, etc. Help us keep this way with support on Patreon!